signing

Documentation

Index

• func Decrypt(data []byte, password string) ([]byte, error)
• func Encrypt(plaintext []byte, password string) ([]byte, error)
• func EnsureInsideDir(baseDir, target string) error
• func RejectSymlinkIfExists(path string) error
• type GitStore
  • func (g *GitStore) Cleanup() error
  • func (g *GitStore) Clone(ctx context.Context, allowCreate bool) error
  • func (g *GitStore) CommitAndPush(ctx context.Context, message string) error
  • func (g *GitStore) ListEncryptedFiles() ([]string, error)
  • func (g *GitStore) ReadEncryptedFile(relPath string, password string) ([]byte, error)
  • func (g *GitStore) WriteEncryptedFile(relPath string, plaintext []byte, password string) error

Functions

func Decrypt

func Decrypt(data []byte, password string) ([]byte, error)

Decrypt decrypts data encrypted by Encrypt.

func Encrypt

func Encrypt(plaintext []byte, password string) ([]byte, error)

Encrypt encrypts plaintext using AES-256-GCM with a password-derived key. Output format: salt (16 bytes) || nonce (12 bytes) || ciphertext+tag.

func EnsureInsideDir

func EnsureInsideDir(baseDir, target string) error

EnsureInsideDir checks that target stays inside baseDir and does not traverse any symlinked parent directories.

func RejectSymlinkIfExists

func RejectSymlinkIfExists(path string) error

RejectSymlinkIfExists rejects writes through an existing symlink path.

Types

type GitStore

type GitStore struct {
	RepoURL  string
	LocalDir string
	Branch   string
}

GitStore manages an encrypted git repository of signing assets.

func (*GitStore) Cleanup

func (g *GitStore) Cleanup() error

Cleanup removes the local clone directory.

func (*GitStore) Clone

func (g *GitStore) Clone(ctx context.Context, allowCreate bool) error

Clone clones the git repo. If allowCreate is true (push mode), falls back to initializing an empty repo when the branch doesn't exist. If false (pull mode), fails when the branch is missing.

func (*GitStore) CommitAndPush

func (g *GitStore) CommitAndPush(ctx context.Context, message string) error

CommitAndPush stages all changes, commits, and pushes.

func (*GitStore) ListEncryptedFiles

func (g *GitStore) ListEncryptedFiles() ([]string, error)

ListEncryptedFiles returns relative paths (without .enc) of all encrypted files.

func (*GitStore) ReadEncryptedFile

func (g *GitStore) ReadEncryptedFile(relPath string, password string) ([]byte, error)

ReadEncryptedFile reads and decrypts a file from the repo. Rejects symlinks to prevent reading outside the clone directory.

func (*GitStore) WriteEncryptedFile

func (g *GitStore) WriteEncryptedFile(relPath string, plaintext []byte, password string) error

WriteEncryptedFile writes an encrypted file into the repo. Validates that the resolved path stays inside LocalDir to prevent symlink escapes.